$6.3bn gone: at crypto exchanges, the balance sheet pays in the end
On 29 October about $6.3bn left wallets of Binance, the largest crypto exchange, by its own estimate; around $3bn has been frozen and withdrawals are suspended.
The largest known crypto theft began, according to Binance, with one engineer's compromised laptop rather than a cracked key. Whether customers are made whole now depends on the reserves and equity of a private company.
What happened
Data from TRM Labs, an analytics firm, show that about $6.36bn left Binance wallets across ten blockchains on the evening of 29 October, most of it within roughly 20 minutes. That is about four times the $1.5bn taken from Bybit in February 2025. TRM and Chainalysis attribute the attack with high confidence to TraderTraitor, a North Korean group; Chainalysis puts the haul at $5.9bn. Binance's initial finding points to a compromised work computer belonging to a DevOps employee, which may have been used to trigger withdrawals; the exchange says it has found no sign that private keys leaked. Stablecoin issuers stepped in: Tether froze more than 1.5bn USDT, according to its chief executive, and Circle more than 800m USDC. Bitcoin fell by 4.8 per cent and BNB by 8 per cent, according to CoinDesk. Assessment: the case shows two things. The weakness lay in operations, not cryptography. And central stablecoin issuers can freeze money on-chain, which limits the damage here but qualifies the promise of censorship-resistant assets.
What follows
Binance says it will cover all losses from SAFU, its emergency fund, and from company money. According to Forbes, SAFU recently held about 15,000 bitcoin, only part of the sum that is not frozen; the rest would have to come from the balance sheet. Whether that suffices cannot be checked from outside until Binance publishes the new proof of reserves it has promised. For European supervisors the case strengthens the argument for closer scrutiny of crypto providers' operational security and capital buffers under the MiCA regulation. For banks offering crypto custody, access controls on staff computers become a central question.
What changes in practice
- Crypto-exchange customers
- Balances on an exchange are a claim on the company. At Binance withdrawals are suspended until the incident is resolved.
- Firms with crypto exposure
- Binance says entry came via an employee laptop. Access rights to withdrawal systems and device security move into focus.
- Stablecoin holders
- Tether and Circle together froze more than $2.3bn. Issuers can freeze balances on-chain.
What to watch
- When Binance fully reopens withdrawals
- Binance's new proof of reserves after the incident
- Further freezes by Tether, Circle and other issuers
Sources
- TRM Labs: North Korea steals USD 6.36 billion from Binance
- CoinDesk: Binance loses over $6 billion in the largest crypto hack to date
- Fox Business: Binance says security incident had estimated $6.3B impact
- Forbes: Binance's $6.3 billion hack started with one engineer's laptop